← All posts

The SEC's "Material Cybersecurity Incidents" Box Holds Filings That Say Material, Don't Know Yet, and No Material Impact Found

Published November 2026 · 27 min read

Written 2026-11-10. All facts are as of that date.

When a US public company files a Form 8-K under Item 1.05, what has it told you? The item's heading, "Material Cybersecurity Incidents", says the incident was material. This post counts every such filing from the first day the item applied to 2026-11-10. It then reads the passages on materiality in 17 of them and sorts them by one stated rule. The box does not mean one thing. Six of the 17 state that the incident or its impact is, or is likely to be, material. Eight say the impact or its materiality is not yet determined, is still being assessed, or cannot yet be estimated. Three report only that no material impact has been found or is expected. All three of the last kind came after a May 2024 SEC staff statement that repeated the Commission's words in adopting the rule: an Item 1.05 disclosure is "by definition material". They are AT&T (2024-07-12), Nucor's amendment (2025-06-20) and Park Dental (2026-10-13). Only Nucor's has a reason in the rule itself: it amends Nucor's earlier Item 1.05 filing, and the rule sends such amendments through Item 1.05. For AT&T there is a possible explanation, which its filing does not state. Park Dental's is a follow-up to its own earlier Item 1.05 filing, which I did not read, so why it took that route is not established.

Terms

What the rule requires

The final rule was adopted on 2023-07-26 (Release 33-11216, Federal Register, 2023-08-04, document 2023-16194). Item 1.05(a) reads: "If the registrant experiences a cybersecurity incident that is determined by the registrant to be material, describe the material aspects of the nature, scope, and timing of the incident, and the material impact or reasonably likely material impact on the registrant, including its financial condition and results of operations."

Three further provisions matter here:

The SEC's press release of 2023-07-26 (2023-139) set the start: "The Form 8-K and Form 6-K disclosures will be due beginning the later of 90 days after the date of publication in the Federal Register or December 18, 2023." And: "Smaller reporting companies will have an additional 180 days before they must begin providing the Form 8-K disclosure."

The agency's best case

On 2024-05-21 Erik Gerding, Director of the SEC's Division of Corporation Finance, published a statement titled "Disclosure of Cybersecurity Incidents Determined To Be Material and Other Cybersecurity Incidents". His reasoning, in his words where I have his whole sentence, and in the Commission's where he quotes it:

The hedge in the third point is at its start: the risk is that investors misperceive if all incidents are filed under 1.05. The statement also sets its own limits: "This clarification is not intended to discourage companies from voluntarily disclosing cybersecurity incidents for which they have not yet made a materiality determination, or from disclosing incidents that companies determine to be immaterial." It also provides for a case where the impact is unknown: "There also may be cases in which a cybersecurity incident is so significant that a company determines it to be material even though the company has not yet determined its impact (or reasonably likely impact). In those cases, the company should disclose the incident in an Item 1.05 Form 8-K, include a statement noting that the company has not yet determined the impact (or reasonably likely impact) of the incident, and amend the Form 8-K to disclose the impact once that information is available." The condition is that the company has determined the incident to be material. And a footnote says that the statement, like all staff statements, has no legal force or effect.

That is a reasonable aim: keep the 1.05 label for incidents a company has judged material, so that investors can trust it. The test below is whether the filings show that outcome.

The count

Method, so you can redo it. I queried EDGAR full-text search for the phrase "Item 1.05", restricted to Form 8-K, by filing-date range:

https://efts.sec.gov/LATEST/search-index?q=%22Item%201.05%22&forms=8-K&dateRange=custom&startdt=YYYY-MM-DD&enddt=YYYY-MM-DD

Each hit carries the list of items the filer declared. I kept only hits whose declared items include 1.05, which drops exhibits and filings that merely mention the item. Searching forms=8-K returns amendments as well. Searching forms=8-K,8-K/A returned only amendments, so I avoided it. Every range returned fewer than 100 hits.

Filing dates Hits With 1.05 declared Original 8-K 8-K/A
2023-12-18 to 2024-05-21 26 26 17 9
2024-05-22 to 2024-12-31 18 15 9 6
2025-01-01 to 2025-12-31 20 19 15 4
2026-01-01 to 2026-11-10 33 25 18 7

Check: 17+9 = 26; 9+6 = 15; 15+4 = 19; 18+7 = 25.

Counting each company once, by its first original Item 1.05 filing in a period (Stryker is counted by its 8-K/A, its first 1.05 filing):

Rates per month, using 30.44 days as the average month (365.25 ÷ 12):

So the rate of new Item 1.05 companies fell by about 63% after the statement (1.22 ÷ 3.32 = 0.37), and has risen somewhat in 2026.

Cross-check. The law firm Debevoise & Plimpton published an alert on 2025-02-11, which Meredith Ervine summarised on TheCorporateCounsel.net on 2025-03-19. By that summary, Debevoise counted 26 companies that had reported a cybersecurity incident under Item 1.05 as of February 11. My 17 + 9 = 26 through 2024 matches, and no new company filed between 2025-01-01 and 2025-02-11 (Lee Enterprises' first filing is dated 2025-02-18). Debevoise's own page says: "Following a statement by the Director of the SEC's Division of Corporation Finance in May 2024, there has been a clear trend of companies disclosing non-material cybersecurity incidents under Item 8.01 of Form 8-K instead of Item 1.05, reserving the use of Item 1.05 of Form 8-K for cybersecurity incidents determined to have had, or which are reasonably likely to have, a material impact on a company's business." The summary adds that there was a notable shift to Item 8.01 after the statement, with 28 companies using Item 8.01 afterwards. I have no count of my own for Item 8.01 (see the end).

Two things changed at once. Section II.I of the release sets 2024-06-15 as the date from which smaller reporting companies must comply with Item 1.05. The press release's 180 days give the same date: from 2023-12-18 it is 13 days to December 31, then 31 (44), 29 (73, as 2024 is a leap year), 31 (104), 30 (134), 31 (165), and 15 days of June (180), which is 2024-06-15. Smaller companies joined 25 days after the statement (2024-05-21 to 2024-06-15). The fall in the count therefore coincides with the statement, and the documents do not show the statement caused it.

What the filings say

I read the passages on materiality and impact in 17 Item 1.05 filings from 16 companies. They are not a random sample: I chose them for size, for recent dates, or because they appeared in the hit lists. Every heading names the item "Material Cybersecurity Incidents" except Coinbase's and National Presto's, which use the singular, Incident.

Most filings say more than one kind of thing about materiality, so I sorted them by one rule, applied in this order, which puts each filing in exactly one group:

I applied the rule to each filing's Item 1.05 text, not to its forward-looking-statements boilerplate; Nucor's amendment lists "the Company's ongoing assessment of the impacts" only there, and Park Dental says only that it will update its disclosure if new information affects its assessment.

These groups describe what the text says. They are not findings about what each company decided. Three placements (National Presto, Coupang and Hewlett Packard Enterprise) are judgement calls, and I say why where each comes.

A. A stated finding that the incident or its impact is, or is likely to be, material (6 filings).

Every one of the six also says something narrower. Amgen, Stryker and Boston Scientific each say they do not expect a material impact somewhere: on financial condition, on full-year guidance, on long-term financial condition. Lee and Data I/O say the full scope is not yet known. Conduent says the event itself had no material effect on operations or costs. So a group A filing often calls one quarter, one set of costs or one kind of harm material, not the whole incident in every respect.

Amgen is the most useful single case. It calls the incident material and in the next breath says it is not reasonably likely to have a material financial impact. The determination rests on how many files were affected and how sensitive they might be. Material in this rule is a securities-law judgement about what a reasonable shareholder would consider important. It does not mean large financial loss.

B. Impact or materiality said to be undetermined, being assessed or not yet estimable (8 filings). None states a materiality determination in the passages I read.

Two things follow from these texts. First, an undetermined impact is a case Gerding's statement provides for (quoted above), and Instruction 2 requires a filing to say what information is not yet determined or available. Second, General Instruction B.1 ties a 1.05 filing to the company having determined that the incident is material, and these filings do not state that. Either the company made the determination and did not say so, or it did not make it; the texts do not settle which. So group B is not shown to depart from the statement. It shows that the label does not tell the reader whether a materiality determination was made.

C. Reports no material impact found or expected, and nothing of the B kind (3 filings). None of these says the incident is not material. Each speaks of impact, and Amgen (above) shows that an incident can be judged material while its financial impact is not expected to be.

So the box held a stated material finding (6), impact undetermined, being assessed or not yet estimable (8), and only no material impact found or expected (3): 6 + 8 + 3 = 17 filings. If the three judgement calls went the other way, Hewlett Packard Enterprise and Coupang would move to C and National Presto to A. The reading does not show how common each group is among all 58 companies; I read 17 filings from 16 companies.

The same sentence under two items

Microsoft's 2024 Item 1.05 filing says "The Company has not yet determined whether the incident is reasonably likely to materially impact the Company's financial condition or results of operations." Near-identical wording also appears under Item 8.01. Stryker, 2026-03-11: "Accordingly, the Company has not yet determined whether the incident is reasonably likely to have a material impact on the Company." Boston Scientific, 2026-08-26, uses the same sentence. Alaska Air Group, 2025-06-27, says it has not yet determined whether the incident is reasonably likely to materially impact its financial condition or results of operations. This is a sample, not a count. It shows the same sentence under both items. It does not show a move from one box to the other: six of the eight group B filings (Coinbase, National Presto, Nucor, F5, Coupang, Nutex) are Item 1.05 filings made after the statement.

Three companies that moved from 8.01 to 1.05

Company 8.01 filing 1.05 filing Gap
Stryker 8-K 2026-03-11 8-K/A 2026-04-09 29 days
Nutex Health 8-K 2026-08-24 8-K 2026-08-31 7 days
Boston Scientific 8-K 2026-08-26 8-K 2026-09-08 13 days

Gaps: Stryker, March 11 to 31 is 20 days plus 9 in April = 29; Nutex, 31 − 24 = 7; Boston Scientific, August 26 to 31 is 5 days plus 8 in September = 13.

Stryker and Boston Scientific fit what the statement describes. Each reported first under 8.01, said it had not yet determined whether a material impact was reasonably likely, and later filed under 1.05 with a stated determination (group A). For this case Gerding wrote that a company should file an Item 1.05 Form 8-K within four business days of the later materiality determination. Stryker did it by amending its 8.01 report with an 8-K/A. Whether an amendment meets that wording, nothing I read settles.

Nutex is the odd one. Its 8.01 filing of 2026-08-24 said: "As of the date of this Current Report on Form 8-K, the Company does not believe that the unauthorized access has had, or is reasonably likely to have, a material impact on the Company's business strategy, operations, financial condition or results of operations." A week later its 1.05 filing said: "The third party has threatened to post such information externally." It noted a class action, Haley v. Nutex Health, Inc., No. 4:26-cv-07197 (S.D. Tex.), filed on 2026-08-27, and said: "To date, the Company has not identified any material impact on its business operations or financial reporting systems." It states no materiality determination. A press release attached to an 8-K filed 2026-09-11 says the third party has published the data it allegedly obtained, and states: "Based on the information currently available, the Company's assessment of the materiality of this event, as set forth in the August 31, 2026 8-K, has not changed." The staff statement lists litigation among the qualitative factors, so the lawsuit and the threat may be why the company moved. That is an inference from what the filing does not say. Nutex never writes that it determined the incident is material, so a reader cannot tell from the text what the 1.05 label rests on.

For contrast, two 8.01 filings name the other route. NovoCure, 2026-09-01: "At this time, we do not believe that this cybersecurity incident will have a material impact or reasonably likely material impact on our financial condition and results of operations; however, at the time of this filing we are continuing to ascertain additional information regarding this incident." It promises an amendment under Item 1.05 if that changes. Globe Life, 2024-06-14, says the incident has not had a material impact on its operations and that it has not determined whether this is a material cybersecurity incident that must be reported under Item 1.05.

What this means for a reader

What could not be established

Sources

All read 2026-11-10.

← All posts